Doki

Quick Start · Features · Architecture · CLI · Performance · Contributing

The Universal Container Engine

Docker and Podman compatible API · OCI native · Kubernetes CRI-ready
Runs on Linux, macOS, and Android via Termux · ARM64, ARMv7 & x86_64
Rootless-first architecture · No daemon required · Hardware-level microVM isolation

Overview

Doki is a container engine designed for every Linux kernel, from Android phones to cloud servers. It works without root, without systemd, and without a hypervisor. When your hardware offers more -- KVM, Android's built-in hypervisors, Linux namespaces -- Doki scales up its isolation automatically.

Binary Availability by Platform (v0.10.0)

Note: Android ARMv7 binaries are built with GOOS=linux (Go 1.22+ requires external linker for GOOS=android on 32-bit ARM). The binaries run via proot; Android detection uses filesystem probes.

dokid, doki-compose, and doki-init are Linux/Android only — they depend on Linux namespaces, cgroups v2, and overlayfs syscalls. On macOS, doki runs in ModeNative only and connects to a remote daemon over the network if needed.

Comparison

What Doki Replaces

Features

Quick Start

Install

curl -sL https://doki.opceanai.com | sh

First Run

# Start the daemon
dokid &

# Pull and run
doki pull alpine
doki run alpine echo "Hello from Doki"

# Check what's running
doki ps
doki images

Use with Docker CLI

export DOCKER_HOST=unix:///var/run/doki.sock
docker ps
docker images
docker run alpine echo "via docker cli"
docker-compose up

Use with Docker SDKs

import docker
client = docker.DockerClient(base_url="unix:///var/run/doki.sock")
client.containers.run("alpine", "echo hello")

const Docker = require('dockerode');
const docker = new Docker({ socketPath: '/var/run/doki.sock' });
docker.listContainers().then(console.log);

Binaries

Architecture

Pipeline

When Doki runs a container, it goes through this pipeline:

1. Image Resolution -- Parse reference, contact registry, authenticate, resolve manifest for current architecture, download layers
2. Rootfs Construction -- Extract layers in order, build complete container filesystem with path traversal protection
3. Execution Mode Selection -- Probe system and select best runner from 12 available modes: WASM, pKVM, microVM, sysbox, namespaces, gVisor, FEX, QEMU, proot, legacy32, chroot, or native
4. Process Execution -- Execute container command within chosen isolation context with environment variables applied
5. Lifecycle Management -- Monitor process, record exit codes, write logs, execute health checks, enforce restart policies

Isolation Levels

Doki selects the strongest isolation mode available on your hardware. Each mode exists for a specific use case:

MicroVM Support

DokiVM provides hardware-level isolation via lightweight virtual machines.

Isolation Level Decision Tree

The runner registry in pkg/runtime/registry.go probes the host and selects the strongest mode that works. Override with doki run --runtime <mode>:

%%{init: {'theme':'base', 'themeVariables':{'primaryColor':'#1e1e2e','primaryTextColor':'#cdd6f4','primaryBorderColor':'#89b4fa','lineColor':'#89b4fa','fontFamily':'ui-monospace,SFMono-Regular,Menlo,Monaco,monospace'}}}%%
flowchart TD
    Host(("Host"))
    Host --- HW
    Host --- Kernel
    Host --- Emu
    Host --- Userspace
    Host --- Compat
    Host --- Sandbox
    Host --- None

    subgraph HW ["Hardware VM"]
        PKVM["pKVM / Microdroid<br/>Android 15+ protected VM"]
        MicroVM["MicroVM<br/>KVM · Gunyah · GenieZone · Halla"]
    end

    subgraph Kernel ["Kernel"]
        Sysbox["Sysbox<br/>rootless DinD"]
        Namespaces["Namespaces<br/>default, rootful"]
        GVisor["gVisor<br/>defense-in-depth"]
    end

    subgraph Emu ["Emulation"]
        FEX["FEX-Emu<br/>x86 on ARM"]
        QEMU["QEMU User<br/>cross-arch"]
    end

    Userspace["Proot<br/>Android default, no root"]
    subgraph Compat ["Compat"]
        Legacy32["Legacy32<br/>ARMv7 on ARM64"]
        Chroot["Chroot<br/>filesystem only"]
    end

    Sandbox["WASM<br/>untrusted code"]
    None["Native<br/>zero overhead fallback"]

The decision logic in runtime.go:detectMode() walks top-down and returns the first mode that passes its probe. To force a specific mode regardless of detection:

doki run --runtime proot alpine echo "always proot"
doki run --runtime native alpine echo "no isolation"
doki run --runtime wasm wasi-example.wasm

CLI

Doki provides 108 commands across 8 categories.

Container Management

Image Management

Network, Volume, System

Podman and Kubernetes

Dokifile Builder

Doki reads Dokifiles (or standard Dockerfiles) and builds OCI-compatible images. The parser supports all 18 Dockerfile instructions, multi-stage builds, heredocs, and parser directives.

Supported Instructions

FROM      RUN       CMD       LABEL     EXPOSE    ENV
ADD       COPY      ENTRYPOINT VOLUME   USER      WORKDIR
ARG       ONBUILD   STOPSIGNAL HEALTHCHECK SHELL  MAINTAINER

Example

FROM alpine:latest AS builder
RUN apk add --no-cache gcc musl-dev
WORKDIR /build
COPY . .
RUN gcc -static -o app main.c

FROM alpine:latest
COPY --from=builder /build/app /usr/local/bin/app
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=3s CMD wget -q --spider http://localhost:8080/ || exit 1
USER nobody
CMD ["/usr/local/bin/app"]

Compose

Full Compose Specification support for multi-container applications.

Supported Features

Example

name: production-stack

services:
  web:
    image: nginx:alpine
    ports: ["80:80", "443:443"]
    volumes:
      - web-data:/usr/share/nginx/html
    depends_on:
      api:
        condition: service_healthy
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: 256M
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost/health"]
      interval: 10s
      retries: 3

  api:
    image: python:3-alpine
    command: uvicorn main:app --host 0.0.0.0
    environment:
      DATABASE_URL: postgresql://user:pass@db:5432/app
    depends_on:
      db:
        condition: service_started

  db:
    image: postgres:alpine
    volumes:
      - db-data:/var/lib/postgresql/data
    secrets:
      - db-password

REST API

Doki exposes the Docker Engine API v1.54 and Podman libpod API v5 over Unix sockets. 53+ Docker endpoints + 39 Podman endpoints.

Key Endpoints

Networking

Port Mapping

doki run -p 8080:80 nginx:alpine                    # Map host 8080 to container 80
doki run -p 127.0.0.1:8080:80 nginx:alpine          # Bind to specific IP
doki run -p 8080:80/tcp -p 8080:80/udp              # TCP and UDP
doki run -P nginx:alpine                            # Publish all EXPOSEd ports
doki run -p 8080-8090:80 nginx:alpine               # Port range

DokiLink-Lite (Multi-Host Mesh, v0.9.3)

Doki 0.9.3 ships DokiLink-Lite, a TCP/UDP proxy + mesh layer that lets you forward a container's published port to another Doki instance. Pure Go stdlib + crypto/tls + golang.org/x/crypto/nacl, no gVisor, no full WireGuard stack, no NAT traversal, no relay.

# Show the local install id and public key.
doki mesh status
# install id:    fndwnv3mn7dt
# public key:    K0dm12xvxzUTBZ3lJkOcOyBrGPPNlCWpTJhcEv0BQys=

# Add a static peer.
doki link add mybuddy 192.168.1.42:7432 \
  --pub "$(doki mesh status | awk '/public key/ {print $3}')"

# Now publish a container reachable through the mesh.
doki run -d -p 0.0.0.0:9090:80 --name web nginx:alpine

Encryption layers:

• L0 (none): loopback only — default on Android/Termux
• L1 (TLS 1.3): default, signed by per-install ECDSA P-256 CA
• L2 (secretbox): opt-in with DOKI_LINK_PAYLOAD_ENC=1, key derived from both peers' Ed25519 public keys

See .wiki/Networking.md for the full architecture, sequence diagrams, and limitations (no DHT, no NAT traversal, mDNS LAN-only).

DNS Architecture (v0.9.2 rewrite)

Doki runs an internal DNS server that handles inter-container name resolution and forwards external queries to upstream resolvers. The architecture:

%%{init: {'theme':'base', 'themeVariables':{'primaryColor':'#1e1e2e','primaryTextColor':'#cdd6f4','primaryBorderColor':'#89b4fa','lineColor':'#89b4fa','fontFamily':'ui-monospace,SFMono-Regular,Menlo,Monaco,monospace'}}}%%
flowchart TD
    Resolv["Container /etc/resolv.conf<br/>nameserver 127.0.0.11"]
    Doki["Doki internal DNS<br/>:8053 Android · :53 Linux"]
    Local["Local<br/>container-name → bridge IP"]
    Upstream["Upstream<br/>getprop net.dns* · /etc/resolv.conf · 8.8.8.8"]
    Internet(("Internet"))

    Resolv -->|"A · AAAA · PTR"| Doki
    Doki --> Local
    Doki --> Upstream
    Upstream --> Internet

Defaults (v0.9.2)

Override with DOKI_DNS_LISTEN=IP:PORT env var or dns_listen in config.json.

Container name resolution

$ doki network create backend
$ doki run -d --name db --network backend postgres:alpine
$ doki run -d --name api --network backend my-api:latest
$ doki exec api sh -c 'getent hosts db'
172.20.0.2      db.backend

The DNS server stores entries in an LRU cache (1024 entries, 5 min TTL) and registers them on container start via SetupNetwork in pkg/network/manager.go. After daemon restart, recoverContainers calls ReRegisterDNS so names keep resolving.

Key behaviors

• AAAA + PTR: IPv6 forward and reverse lookups work alongside A records
• ndots:0: container names like forgejo resolve directly, no forgejo.local retry loop
• TCP retry: when upstream UDP returns TC bit, the query is retried over TCP per RFC 5966
• no busy-wait: ReadFromUDP blocks on the socket, no polling loop

Port Forwarding Internals (v0.9.2 fix)

Port mapping uses iptables DNAT in root mode and socat in rootless mode. The v0.9.2 fix targets the DNAT rule construction:

// pkg/network/manager.go: ensurePortForward
args := []string{
    "-A", "OUTPUT",                  // ← added in v0.9.2 (was missing)
    "-p", "tcp",
    "--dport", strconv.Itoa(hostPort),
    "-j", "DNAT",
    "--to-destination", containerIP + ":" + strconv.Itoa(containerPort),
}
exec.Command("iptables", args...).CombinedOutput()  // ← error was discarded in v0.9.1

v0.9.1 bug: -A OUTPUT was missing, so iptables saw OUTPUT as a target name → "Unknown option" → silently swallowed. Result: container outbound to host port worked, but inbound from host to container didn't.

v0.9.1 bug: socat connected to localhost:containerPort instead of containerIP:containerPort. From the host, localhost:8080 couldn't reach the container's bridge IP.

v0.9.2 fix: DNAT now uses []string (no shell parsing), targets the container bridge IP (Endpoint.VethPeer), and also handles UDP via socat -u for protocols other than TCP.

Veth Teardown (v0.9.2 fix)

The Endpoint struct gained two fields in v0.9.2 to make teardown idempotent:

// pkg/network/manager.go
type Endpoint struct {
    // ...existing fields...
    VethHost string  // host-side interface name (e.g. "vethabc123")
    VethPeer string  // container-side interface name (e.g. "eth0")
}

teardownBridgeNetwork() now deletes both veth ends via ip link del vethHost before removing the bridge. Before: orphaned veth pairs accumulated on the host (ip link would show dozens of veth* interfaces after running a few containers).

Storage

Security

Blocked Syscalls

init_module, finit_module, delete_module    # Module loading
kexec_load, kexec_file_load                 # Kernel execution
iopl, ioperm                                # Hardware I/O
kcmp                                        # Kernel info leaks
process_vm_readv, process_vm_writev         # Process memory access

Allowed Modern Syscalls

io_uring_setup, io_uring_enter, io_uring_register  # Async I/O
pidfd_open, pidfd_send_signal, pidfd_getfd         # PID file descriptors
rseq, userfaultfd, copy_file_range                 # Modern kernel features
landlock_create_ruleset, landlock_add_rule         # Landlock sandboxing

Performance

Measured on Qualcomm Snapdragon 685, Android 14, Termux. Cold pull, ARM64 native binaries.

Registries

Compatible with any OCI or Docker Registry HTTP API v2.

Verified Images

alpine, busybox, python:3-alpine, node:22-alpine, nginx:alpine, redis:alpine, mariadb, postgres:alpine, nextcloud, ubuntu, debian, golang, rust, ruby, php, traefik, caddy, vault

Supported Distros

doki run --distro alpine   echo hello
doki run --distro ubuntu   bash
doki run --distro debian   --install curl,vim bash
doki run --distro arch
doki run --distro fedora
doki run --distro rocky
doki run --distro gentoo
doki run --distro opensuse

Configuration

Daemon Config (~/.doki/config.json)

{
  "root": "/data/data/com.termux/files/usr/var/lib/doki",
  "socket_path": "/data/data/com.termux/files/usr/var/run/doki.sock",
  "storage_driver": "fuse-overlayfs",
  "default_network": "bridge",
  "debug": false,
  "log_level": "info",
  "rootless": true,
  "dns": ["8.8.8.8", "8.8.4.4"],
  "registry_mirrors": [],
  "insecure_registries": []
}

Environment Variables

Building

Requirements

• Go 1.22 or later
• make (optional)
• For microVM mode: crosvm or firecracker binary (auto-detected)

Build Targets

# Android / Termux (ARM64)
make build-android-arm64
make install

# Android / Termux (ARMv7)
make build-android-armv7

# Linux (ARM64)
make build-linux-arm64

# Linux (ARMv7)
make build-linux-armv7

# macOS (Apple Silicon)
make build-darwin-arm64

# All platforms at once
make release

# SHA256 checksums
make sha256

# Testing & linting
make test      # go test ./...
make vet       # go vet ./...
make clean     # rm -rf releases/

Manual Build

make release
# Or equivalently:
go build -trimpath -ldflags="-s -w" -o releases/doki ./cmd/doki
go build -trimpath -ldflags="-s -w" -o releases/dokid ./cmd/dokid
go build -trimpath -ldflags="-s -w" -o releases/doki-compose ./cmd/doki-compose
go build -trimpath -ldflags="-s -w" -o releases/doki-init ./cmd/doki-init

Project Structure

Doki/
  cmd/
    doki/                 CLI binary (108 commands, 1600+ lines)
    dokid/                Daemon binary (REST API, TLS, rate limiting)
    doki-compose/         Docker Compose compatible CLI
    doki-init/            Minimal PID 1 for containers (Go)
    doki-init-rust/       Minimal PID 1 for microVM guests (Rust, 412K)
    doki-kube/            Kubernetes control plane (all-in-one)
    doki-kubectl/         kubectl-compatible CLI client
    dokitest/             Integration test suite
    regtest/              Registry test suite
  pkg/
    api/                  Docker Engine API v1.54 server
    podman/               Podman libpod v5 API (39 endpoints)
    compose/              Compose engine with watch + publish
    apiserver/            Kubernetes API server
    kubelet/              Kubernetes kubelet agent
    scheduler/            Kubernetes scheduler
    controllers/          Kubernetes controllers (10 controllers)
    kubeproxy/            Kubernetes kube-proxy
    coredns/              Cluster DNS for Kubernetes
    kubectl/              kubectl HTTP client library
    k8s-types/            80 Kubernetes API types
    store/                In-memory state store with watch
    runtime/              OCI runtime with 12 execution modes
    image/                OCI image management (pull, push, build)
    registry/             OCI Distribution Spec client
    network/              Container networking (bridge, CNI, DNS, pasta)
    storage/              Storage drivers (overlay2, fuse, btrfs, zfs)
    builder/              Dokifile parser (18 instructions, multi-stage)
    cli/                  CLI library (3200+ lines)
    common/               Shared types, config, utilities
    netlink/              DokiLink-Lite mesh networking
    landlock/             Landlock LSM sandbox (Linux 5.13+)
    macos/                macOS native VM (VZ + QEMU backends)
    security/             Seccomp and AppArmor profiles
    distro/               Linux distribution management
    cri/                  Kubernetes CRI plugin
    oci/                  OCI spec generation
    deps/                 Dependency management
    scheduler/            Pod scheduling
  internal/
    dokivm/               MicroVM subsystem (crosvm, firecracker, qemu)
    namespaces/           Linux namespace management
    cgroups/              cgroups v2 resource management
    fuse/                 FUSE overlay filesystem operations
    proot/                Proot fallback for Android
    seccomp/              Seccomp profile engine
    apparmor/             AppArmor profile generator
  doki-os/                doki-OS VM kernel config + Makefile

158 Go source files. 55,000+ lines of code. 9 compiled binaries. 21 external dependencies.

Known Limitations

What Works

What Does NOT Work Yet

Fixed in v0.9.3 (moved from this list)

• kill not updating state — fixed in v0.9.3, polls with signal(0) after kill
• stop not updating state — fixed in v0.9.3, always saves exited state
• Exec no output — fixed in v0.9.3, returns stdout/stderr bytes
• Compose flags after command ignored — fixed in v0.9.3, parser continues after subcommand
• Container list Name empty — fixed in v0.9.3, stateToInfo sets Name
• Create ignores ?name= — fixed in v0.9.3, reads URL query parameter
• Image inspect Config lowercase — fixed in v0.9.3, PascalCase conversion
• ps --format not implemented — fixed in v0.9.3, template execution
• doki cp stub — fixed in v0.9.3, tar extraction working

Fixed in v0.9.2 (moved from this list)

• iptables DNAT — fixed in v0.9.2, see "Port Forwarding Internals" above
• Port forwarding to localhost — fixed in v0.9.2, targets container bridge IP
• Orphaned veth pairs on teardown — fixed in v0.9.2, ip link del in teardown
• proot failing on hosts without proot binary — fixed, FindProotBinary() falls back to system PATH
• Android DNS using Google 8.8.8.8 — fixed, reads getprop net.dns*

What's New

v0.10.0 (Latest)

Doki 0.10 is a massive expansion: Podman 1:1 API compatibility, full Kubernetes distribution, macOS native VM support, doki-OS VM image, and 20 new dependencies bringing the engine to 55,000+ lines of code across 158 files.

New Platforms & APIs

New Binaries

Dependencies (21 direct, 50 total)

OCI specs (image-spec, runtime-spec, go-digest), gRPC + protobuf, Kubernetes CRI API, containerd v2 OCI, compression (klauspost/compress, xz), Moby utilities (patternmatcher, term), SQLite for K8s state, and more.

Quality

• staticcheck: 0 warnings
• errcheck production: 0 unchecked errors
• go vet: 0 warnings
• gosec: 423 (filesystem/network operations inherent to container engines)
• revive: 351 (documentation/style)
• 158 Go files, 55,000+ LOC, 29 packages, 9 binaries

v0.9.3

This release ships DokiLink-Lite (mesh networking) and 190+ bug fixes across 4 rounds of comprehensive auditing. No breaking changes — fully backward-compatible with v0.9.2.

DokiLink-Lite (Mesh Networking)

A TCP/UDP proxy + mesh layer that lets you forward a container's published port to another Doki instance. Pure Go stdlib + crypto/tls + golang.org/x/crypto/nacl, no gVisor, no full WireGuard stack, no NAT traversal, no relay.

doki mesh status                      # show install id + public key
doki link add mybuddy 192.168.1.42:7432 --pub "..."
doki mesh ls                          # list known peers

Critical Bug Fixes (Round 4)

• kill not updating state — process killed but state stayed "running" forever. Now polls with signal(0) then saves exited state.
• stop not updating state on SIGKILL failure — always saves exit code 137 before returning.
• Exec no output — runtime wrote to daemon stdout, not HTTP response. Changed to return bytes.
• Stop ExitChan race — replaced channel polling with signal(0) polling.
• Compose flags after command — doki-compose up -p 8080:80 now works (parser was ignoring flags after the subcommand).
• flagsWithValue -f — rm -f was skipping the container ID.

High Bug Fixes (Round 4)

• Container list Name always empty — stateToInfo now sets info.Name
• Create ignores ?name= query param — reads ?name= from URL query
• Image inspect Config — converted from OCI lowercase to Docker PascalCase
• Image inspect Created — int64 unix timestamp now converted to RFC3339
• ps --format — template parsing and execution now works
• compose ps -q — returns full container ID, not truncated
• ps ID = Name — CONTAINER ID and NAMES columns now differ
• images sha256: prefix — stripped from REPOSITORY column
• Pull exit code — returns 1 on failure (was always 0)

Medium Bug Fixes (Round 4)

• Rename returns 204 No Content (was 200)
• Stop on already-stopped returns 304 (was 204)
• cp file path — writes directly to target path, not target/basename
• kill on non-running — returns error (was nil)
• logs newlines — each line now ends with \n
• compose config/logs order — sorted alphabetically
• nftables OUTPUT chain — port mapping rules now apply to local traffic
• IPv6 ARPA — arpaToIP handles .ip6.arpa. with 32 nibbles
• mesh onMessage — data race fixed (pubKeyBytes inside RLock)

Other Improvements

• DOKI_USE_SOCAT=1 forces socat fallback for port forwarding
• DOKI_LINK_ADDR overrides gossip listen address
• DOKI_LINK_MESH=0 disables mesh entirely on air-gapped hosts
• Makefile produces .tar.gz archives with SHA256 checksums

v0.9.2

This release is a stability + correctness pass over v0.9.1. No new user-facing commands, but a long list of bugs that were breaking real workflows are now fixed.

Critical networking fixes (the headline of v0.9.2)

These four bugs were silently breaking container networking. All fixed and tested:

1. iptables DNAT missing -A flag — pkg/network/manager.go:684

   • Before: iptables OUTPUT -p tcp --dport 80 -j DNAT ... → "Unknown option", error swallowed
   • After: iptables -A OUTPUT -p tcp --dport 80 -j DNAT ... using []string (no shell parsing)
   • Impact: every host→container port mapping was broken on rootful mode

2. Port forwarding to localhost instead of container IP — pkg/network/manager.go:732

   • Before: socat TCP-LISTEN:8080,fork TCP:localhost:80
   • After: socat TCP-LISTEN:8080,fork TCP:10.0.0.2:80 (container bridge IP)
   • Impact: localhost:8080 from host never reached the container

3. Orphaned veth pairs — pkg/network/manager.go Endpoint struct

   • Before: teardownBridgeNetwork() deleted the bridge but left veth interfaces behind
   • After: Endpoint tracks VethHost/VethPeer, teardown does ip link del vethHost
   • Impact: ip link showed dozens of veth* interfaces after running a few containers

4. proot missing on fresh hosts — internal/proot/manager.go:FindProotBinary

   • Before: hardcoded exec.Command("proot", ...) → ENOENT on hosts without /usr/bin/proot
   • After: FindProotBinary() checks shipped binary, then $PATH; returns empty if neither
   • Impact: proot-based mode was broken on any host that didn't apt install proot

See the "Port Forwarding Internals" and "Veth Teardown" sections above for code-level details.

DNS server rewrite (18 bugs)

The internal DNS server was rewritten end-to-end:

Top fixes:

• Port stripping: nameserver 8.8.8.8:53 (invalid) → nameserver 8.8.8.8
• Auto-registration: containers register their name on first start/run, no manual network connect needed
• Recovery: daemon restart re-registers all running containers via ReRegisterDNS
• AAAA + PTR: IPv6 forward and reverse lookups work alongside A records
• ndots:0: forgejo resolves without forgejo.local. retry
• TCP retry: TC-bit responses trigger a TCP query (some upstreams refuse UDP)
• Blocking socket: ReadFromUDP waits, no busy-wait loop on SetReadDeadline

LD_PRELOAD fix for Termux

libtermux-exec-ld-preload.so is Termux's preloaded library that hooks execve. It breaks proot's ptrace-based syscall forwarding. v0.9.2 strips it via common.StripHostEnv():

// pkg/common/env.go
func StripHostEnv(env []string) []string {
    keep := []string{}
    for _, e := range env {
        if strings.HasPrefix(e, "LD_PRELOAD=") || strings.HasPrefix(e, "LD_LIBRARY_PATH=") {
            continue
        }
        keep = append(keep, e)
    }
    return keep
}

Symptom before fix: "execve: Function not implemented" when running any proot container. After: works normally.

12 isolation levels (runner registry)

pkg/runtime/registry.go now exposes 12 modes. The auto-detection in runtime.go:detectMode() walks top-down and returns the first that passes its probe:

Force a mode with doki run --runtime <mode>.

Cross-platform build matrix (13 binaries)

v0.9.2 ships 13 binaries (was 14 in v0.9.1 — dropped doki-proot and doki-init-rust, they're either auto-detected or source-only now):

darwin-arm64 is CLI-only — dokid, doki-compose, and doki-init are linux-only because they depend on internal/namespaces (linux-only syscalls) and overlayfs mounts. The darwin CLI runs in ModeNative only.

Other improvements

• Unified version string: common.DokiVersion=0.9.2 injected via -ldflags along with GitCommit, BuildDate, BuildUser. Single source of truth, doki version shows the build provenance.
• Structured logging: log/slog replaces stdlib log in daemon, CLI, and middleware. JSON in production, text on TTY (auto-detected from stderr).
• Atomic state persistence: saveState writes to state.json.tmp.* then os.Rename for crash-safety. No more corrupt state.json after a power loss.
• API bumped to v1.48: aligned with Docker Engine 29.5.x (May 2026).
• 16 KiB page size alignment: Android 15+ requires -Wl,-z,max-page-size=16384; the Makefile's build-android-arm64 target passes it via LDFLAGS.
• Metrics + counter hardening: /health and /metrics integrated with the slog pipeline; counters survive process restarts.
• Test coverage: DNS LRU, atomic state, resolv.conf parsing, version invariants all have unit tests.

v0.9.1

• OCI Push: doki push -- blob upload, cross-repo mount, manifest PUT to any OCI registry
• Registry Auth: doki login accepts credentials and propagates to registry client
• Native tar extraction: Go-native tar with whiteouts, path traversal protection, compression auto-detection (gzip/bzip2/xz/zstd), parallel extraction with rollback
• 4 new distros: Fedora, Gentoo, OpenSUSE, Rocky Linux -- 8 distros total
• Improved Compose engine: Long syntax Ports/Volumes, depends_on health conditions with 60s poll, 30+ new fields
• 19 Proot C fixes: SECCOMP_RET_ALLOW, fake_id0 brace bug, stat.c uid/gid fix, link2symlink UB, and more
• Updated seccomp: io_uring, pidfd, rseq, userfaultfd, copy_file_range now allowed
• Overlay2 kernel mount: Uses syscall.Mount("overlay") directly instead of FUSE delegation
• Attach via HTTP hijack: doki attach with bidirectional streaming
• Multi-container wait: Waits for multiple containers simultaneously
• DNS listener: Internal DNS server on port 53 for inter-container resolution
• Buffer pool & String intern pool: Reduced GC pressure and memory deduplication
• PProf endpoint: /debug/pprof/ for profiling
• Systemd socket activation: Linux socket activation support
• ARMv7 beta: Compilation and binaries for 32-bit ARM devices

v0.9.0

• doki-init-rust: PID 1 rewritten in Rust (412K vs 2.9MB Go, -86%)
• doki-proot: Forked proot with daemon mode + JSON IPC protocol. 14K binary
• Distro system: doki run --distro alpine/ubuntu/debian/arch downloads from Docker Hub
• ARMv7 beta: Full feature parity for older ARM devices
• Immich: Full stack running (PostgreSQL 18 + pgvector + cube + earthdistance, Redis 7, Immich Server v2.7.5)

Contributing

Contributions are welcome. Areas where help is most needed:

Development Setup

git clone https://github.com/OpceanAI/Doki.git
cd Doki
go build ./...
go test ./...

Commit Style

• Use imperative mood ("Add feature" not "Added feature")
• Keep the first line under 72 characters
• Reference issues when applicable

License

Apache License 2.0

Copyright 2024-2026 OpceanAI

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Links

Main is the only source of truth. Mirrors are force-synced from main after each release. If you find a divergence, open an issue on GitHub.

Wikis

Related